IBM Computer Hardware 2 User Manual download pdf (Page 45)

CCA Release 2.54

Notes:

1. During the portions of the year when Daylight Savings Time is not in effect, the

time difference between Eastern Standard Time and GMT is 5 hours.

2. In the OS/400 environment, no translation is provided for Role and Profile

names. The Coprocessor will initialize the default role name to DEFAULT

encoded in ASCII. OS/400 CCA users will need to consider the encoding of

Role and Profile names.

Logging On and Logging Off

A user must log on to the Coprocessor in order to activate a user profile and the

associated role. This is the only way to use a role other than the default role. You

log on and log off using the Logon_Control verb, which is described on page 2-52.

When you successfully log on, the CCA implementation establishes a session

between your application program and the Coprocessor's access-control system.

The Security Application Program Interface (SAPI) code stores the logon context

information, which contains the session information needed by the host computer to

protect and validate transactions sent to the Coprocessor. As part of that session,

a randomly derived session key, generated in the Coprocessor, is subsequently

used to protect information you interchange with the Coprocessor. This protection

is described in “Protecting Your Transaction Information” on page 2-9. The logon

process and its algorithms are described in “Passphrase Verification Protocol” on

page D-16.

On OS/2, AIX, and NT, the logon context information resides in memory associated

with the process thread which performed the Logon_Control verb. On OS/400, the

logon context information resides in memory owned by the process in which the

application runs. Host-side logon context information can be saved and shared

with other threads, processes, or programs; see “Use of Logon Context Information”

on page 2-8.

Thus, on OS/2, AIX, and NT, each thread in any process can log on to the CCA

access control system within a specific CCA Coprocessor. Because the

Coprocessor code creates the session key, and the session key is stored in the

active context information, a thread cannot concurrently be logged on to more that

one Coprocessor.

In order to log on, you must prove the user's identity to the Coprocessor. This is

accomplished using a passphrase, a string of up to 64 characters which are known

only to you and the Coprocessor. A good passphrase should not be too short, and

it should contain a mixture of alphabetic characters, numeric characters, and

special symbols such as “*,” “+,” “!,” and others. It should not be comprised of

familiar words or other information which someone might be able to guess.

When you log on, no part of the passphrase ever travels over any interface to the

Coprocessor. The passphrase is hashed and processed into a key that encrypts

information passed to the Coprocessor. The Coprocessor has a copy of the hash

and can construct the same key to recover and validate the log-on information.

CCA does not communicate your passphrase outside of the memory owned by the

calling process.

When you have finished your work with the Coprocessor, you must log off in order

to end your session. This invalidates the session key you established when you

Chapter 2. CCA Node-Management and Access-Control 2-7

1 2 ... 40 41 42 43 44 45 46 47 48 49 50 ... 507 508

IBM Computer Hardware 2 User Manual Page 45

Comments to this Manuals

IBM Computer Hardware 2 User Manual Page 45

Comments to this Manuals

Related products and manuals for Software IBM Computer Hardware 2